A government contractor stores classified project documents in a cloud storage service. The compliance team requires that encryption keys be managed by the contractor, not the cloud provider, and that access to the keys be logged. Which encryption approach should be used?

Customer-managed keys (CMK) stored in a cloud KMS with key access logging enabled.

Cloud-provider-managed keys with automatic rotation.

Client-side encryption with keys stored on-premises.

Envelope encryption using a cloud KMS without logging.

A company is subject to HIPAA and stores electronic protected health information (ePHI) in a cloud environment. The compliance officer needs to prove that the company has implemented safeguards to protect ePHI and can demonstrate compliance during an audit. Which set of practices should be in place?

Encrypt all ePHI and store the encryption keys in a secure location.

Implement access controls, encryption, and audit logging for all systems that store or process ePHI, and maintain a data inventory of ePHI locations.

Rely on the cloud provider's compliance certifications to ensure HIPAA compliance.

Use data masking to de-identify all ePHI in the cloud.

What is the primary purpose of compliance requirements like GDPR and HIPAA in cloud environments?

To increase the cost of cloud services

To standardize cloud service pricing

To limit the use of cloud computing

To ensure that sensitive data is handled in a way that protects individuals' privacy and security

A global company stores customer data in multiple cloud regions. The legal team requires that data for EU residents be stored only in EU regions, and that the company be able to prove where each customer's data is stored. Which combination of controls should be implemented?

Data residency policies that restrict storage to EU regions and a data inventory that maps each customer to its storage location.

Encryption of all customer data with a single global key.

A data loss prevention policy that blocks all data transfers out of the EU.

A network firewall that blocks access to non-EU cloud regions.

A company subject to GDPR needs to demonstrate that it knows where personal data of EU residents is stored and can produce a record of who accessed that data. Which combination of practices should the company implement?

Use data masking to anonymize all personal data in the cloud.

Maintain a data inventory that maps personal data locations and enable detailed access logging on those storage services.

Encrypt all personal data and store encryption keys in a hardware security module.

Implement a data loss prevention policy that blocks all transfers of personal data outside the company.

GIAC Cloud Security Essentials

Domain 5Objective 2

Using Sensitive Data GCLD Practice Questions (Page 6)

Part of the Data Protection and Automation domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 26–30

26expert · hard
A government contractor stores classified project documents in a cloud storage service. The compliance team requires that encryption keys be managed by the contractor, not the cloud provider, and that access to the keys be logged. Which encryption approach should be used?
Select an answer first
27application · medium
A company is subject to HIPAA and stores electronic protected health information (ePHI) in a cloud environment. The compliance officer needs to prove that the company has implemented safeguards to protect ePHI and can demonstrate compliance during an audit. Which set of practices should be in place?
Select an answer first
28foundation · easy
What is the primary purpose of compliance requirements like GDPR and HIPAA in cloud environments?
Select an answer first
29expert · hard
A global company stores customer data in multiple cloud regions. The legal team requires that data for EU residents be stored only in EU regions, and that the company be able to prove where each customer's data is stored. Which combination of controls should be implemented?
Select an answer first
30application · medium
A company subject to GDPR needs to demonstrate that it knows where personal data of EU residents is stored and can produce a record of who accessed that data. Which combination of practices should the company implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.